Splunk® Phantom (Legacy)

Develop Apps for Splunk Phantom

Platform installation for Python 2 and Python 3

The Splunk Phantom installation includes Python 2 and Python 3 runtime environments, so that you can develop Python 2 or 3 compatible apps for the platform.

Python installation path

Python 2 and Python 3 are included the platform installation.

Python 2

Python 2 is included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to Python 2 is <PHANTOM_HOME>/usr/bin/python2.7.

Python 3

Python 3 is included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to Python 3 is <PHANTOM_HOME>/usr/python36/bin/python3.6m.
  • The symlink is <PHANTOM_HOME>/usr/bin/python3 for convenience.
    • The platform relies on this symlink.
    • Use this binary in preparation for any potential platform migrations to python3.7 or python3.8, for example.

Phenv installation path

The phenv script is included in the platform installation for use when setting environment variables for both Python 2 and Python 3. The phenv script is used, for example, when installing packages or when compiling and installing apps. See Compiling and installing the app.

The phenv script is included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to the phenv script is <PHANTOM_HOME>/bin/phenv.

Phenv with Python 2 and Python 3

The phenv script will set the PATH, PYTHONPATH, and LD_LIBRARY_PATH environment variables for both Python 2 and Python 3, as needed.

  • While Python 3 does work without using phenv, this is only because the default system Python is already python3. It loads the wrong, but equivalent, libraries when run without phenv.
  • This means that Python 2 doesn't work without phenv because it's installed in a portable way, and can't find its libraries without phenv python2.7 setting the LD_LIBRARY_PATH environment variable.
  • For both Python versions, phenv will also add the appropriate Splunk Phantom libraries to the PYTHONPATH so they are readily importable.

Pip installation path

Pip 2 and Pip 3 are included in the platform for installing Python 2 and Python 3 packages.

Pip 2

Pip 2 is included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to Pip 2 is <PHANTOM_HOME>/usr/bin/pip2.7.

Use the command along with phenv as follows:

[root@phantom user]# phenv pip2 install termcolor

Pip 3

Pip 3 is included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to Pip 3 is <PHANTOM_HOME>/usr/python36/bin/pip3.
  • The symlink is <PHANTOM_HOME>/usr/bin/pip3 for convenience.
    • The platform relies on this symlink.
    • Use this binary in preparation for any potential platform migrations to pip3.7 or pip3.8, for example.

Use the command along with phenv as follows:

[root@phantom user]# phenv pip install termcolor

App development script installation path

The following scripts are included in the platform for developing Python 2 and Python 3 apps:

  • create_tj.pyc
  • create_output.pyc
  • compile_app.pyc

The script names are the same for each environment, the options are the same, and the outputs are the same.

Compatible Python 2 scripts

Scripts that are compatible with Python 2 are included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to scripts is <PHANTOM_HOME>/bin/py2/<script>.

Run the scripts using phenv python2 as follows:

[phantom@phantom phipinfoio]$ phenv python2.7 <PHANTOM_HOME>/bin/py2/<script>.pyc

Compatible Python 3 scripts

Scripts that are compatible with Python 3 are included in the following location:

  • For standard installations, <PHANTOM_HOME> is /opt/phantom.
  • For non-root installations, <PHANTOM_HOME> is configured by the customer.
  • The path to scripts is <PHANTOM_HOME>/bin/<script>.

Run the scripts using phenv python3 as follows:

[phantom@phantom phipinfoio]$ phenv python <PHANTOM_HOME>/bin/<script>.pyc
Last modified on 11 August, 2020
Map Template   Convert apps from Python 2 to Python 3

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters